User: x is not authorized to perform: (sts:DecodeAuthorizationMessage)`

Question

I am facing an issue while trying to provision my EC2 instance through Terraform. However, to debug that issue I am trying to decode the encoded authorization failure message.

But when trying to call that sts decode API I am getting:

Error: A client error (AccessDenied) occurred when calling the DecodeAuthorizationMessage operation: User: xxx is not authorized to perform: (sts:DecodeAuthorizationMessage)

Now I don't know which specific permission should I give to my IAM user to be able to decode this message?

Updates:

Answer 1

Based on the error message quotued, it seems that sts:DecodeAuthorizationMessage permissions are required:

Decodes additional information about the authorization status of a request from an encoded message returned in response to an AWS request.

Subsequently you could add the following policy as an inline policy, for example, into your IAM user or its group:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowStsDecode",
            "Effect": "Allow",
            "Action": "sts:DecodeAuthorizationMessage",
            "Resource": "*"
        }
    ]
}

The same could be added through Customer Managed Policy if inline policies are not desired.